3 minute read
API keys in frontend code are public
No. Anything in your website's frontend code, including keys in environment variables that start with NEXT_PUBLIC_ or VITE_, is sent to every visitor's browser and can be read by anyone. Secret keys for AI, payments or databases must stay on the server, in a backend route or serverless function that calls the service for you.
Public vs secret
- Fine in the browser: keys designed to be public, like a Stripe publishable key, a Supabase anon key (with Row Level Security on), or a maps key restricted to your domain.
- Never in the browser: OpenAI or Anthropic keys, Stripe secret keys, Supabase service role keys, database passwords, email API keys.
The fix
Make a small server route, for example /api/chat, that holds the secret key and calls the service. Your page calls your route, never the service directly.
How to check your site
Open your live site, press F12, go to Sources, and search for sk_, key and secret. If a real secret shows up, rotate it today.